openstack
/
tripleo-heat-templates
Code Issues Proposed changes

Merge "Add the certificate specs in ceph_mgr service" into stable/train

This commit is contained in:
Zuul 2020-03-10 13:24:04 +00:00 committed by Gerrit Code Review
parent b3d9c160d7 100ed1925c
commit ea99331e7e
9 changed files with 204 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

72
deployment/ceph-ansible/ceph-mgr.yaml
View File

@ -32,19 +32,28 @@ parameters:
type: json
CephDashboardAdminUser:
default: 'admin'
description: Admin user for grafana component
description: Admin user for the dashboard component
type: string
CephDashboardAdminPassword:
description: Admin password for grafana component
description: Admin password for the dashboard component
type: string
hidden: true
CephEnableDashboard:
type: boolean
default: false
description: Parameter used to trigger the dashboard deployment.
EnableInternalTLS:
type: boolean
default: false
conditions:
dashboard_enabled: {equals: [{get_param: CephEnableDashboard}, true]}
internal_tls_enabled:
and:
- dashboard_enabled
- equals:
- get_param: EnableInternalTLS
- true
resources:
CephBase:
@ -70,6 +79,8 @@ resources:
dashboard_rgw_api_port: {get_param: [EndpointMap, CephRgwInternal, port]}
dashboard_rgw_api_scheme: {get_param: [EndpointMap, CephRgwInternal, protocol]}
dashboard_rgw_api_no_ssl_verify: false
dashboard_port: 8444
dashboard_frontend_vip: {get_param: [EndpointMap, CephGrafanaInternal, host]}
outputs:
role_data:
@ -91,7 +102,15 @@ outputs:
block:
- name: set ceph-ansible group vars mgrs
set_fact:
ceph_ansible_group_vars_mgrs: {get_attr: [CephMgrAnsibleVars, value, vars]}
ceph_ansible_group_vars_mgrs:
if:
- internal_tls_enabled
-
map_merge:
- {get_attr: [CephMgrAnsibleVars, value, vars]}
- dashboard_crt: /etc/pki/tls/certs/ceph_dashboard.crt
- dashboard_key: /etc/pki/tls/private/ceph_dashboard.key
- {get_attr: [CephMgrAnsibleVars, value, vars]}
- name: generate ceph-ansible group vars mgrs
copy:
dest: "{{playbook_dir}}/ceph-ansible/group_vars/mgrs.yml"
@ -100,13 +119,40 @@ outputs:
external_upgrade_tasks: {get_attr: [CephBase, role_data, external_upgrade_tasks]}
config_settings:
map_merge:
- tripleo::ceph_mgr::firewall_rules:
'113 ceph_mgr':
dport:
list_concat:
- - '6800-7300'
- if:
- dashboard_enabled
- - '8443'
- []
- {}
- if:
- internal_tls_enabled
-
generate_service_certificates: true
ceph_dashboard_certificate_specs:
service_certificate: '/etc/pki/tls/certs/ceph_dashboard.crt'
service_key: '/etc/pki/tls/private/ceph_dashboard.key'
hostname:
str_replace:
template: "%{hiera('fqdn_NETWORK')}"
params:
NETWORK: {get_param: [ServiceNetMap, CephDashboardNetwork]}
principal:
str_replace:
template: "ceph_dashboard/%{hiera('fqdn_NETWORK')}"
params:
NETWORK: {get_param: [ServiceNetMap, CephDashboardNetwork]}
postsave_cmd: "/usr/bin/certmonger-dashboard-refresh.sh"
- {}
- tripleo::ceph_mgr::firewall_rules:
'113 ceph_mgr':
dport:
list_concat:
- - '6800-7300'
- if:
- dashboard_enabled
- - '8444'
- []
- {}
metadata_settings:
if:
- internal_tls_enabled
-
- service: ceph_dashboard
network: {get_param: [ServiceNetMap, CephDashboardNetwork]}
type: node
- null

1
environments/ssl/no-tls-endpoints-public-ip.yaml
View File

@ -22,6 +22,7 @@ parameter_defaults:
BarbicanAdmin: {protocol: http, port: '9311', host: IP_ADDRESS}
BarbicanInternal: {protocol: http, port: '9311', host: IP_ADDRESS}
BarbicanPublic: {protocol: http, port: '9311', host: IP_ADDRESS}
CephDashboardInternal: {protocol: http, port: '8444', host: IP_ADDRESS}
CephGrafanaInternal: {protocol: http, port: '3100', host: IP_ADDRESS}
CephRgwAdmin: {protocol: http, port: '8080', host: IP_ADDRESS}
CephRgwInternal: {protocol: http, port: '8080', host: IP_ADDRESS}

1
environments/ssl/tls-endpoints-public-dns.yaml
View File

@ -18,6 +18,7 @@ parameter_defaults:
BarbicanAdmin: {protocol: 'http', port: '9311', host: 'IP_ADDRESS'}
BarbicanInternal: {protocol: 'http', port: '9311', host: 'IP_ADDRESS'}
BarbicanPublic: {protocol: 'https', port: '13311', host: 'CLOUDNAME'}
CephDashboardInternal: {protocol: 'https', port: '8444', host: 'CLOUDNAME'}
CephGrafanaInternal: {protocol: 'https', port: '3100', host: 'CLOUDNAME'}
CephRgwAdmin: {protocol: 'http', port: '8080', host: 'IP_ADDRESS'}
CephRgwInternal: {protocol: 'http', port: '8080', host: 'IP_ADDRESS'}

1
environments/ssl/tls-endpoints-public-ip.yaml
View File

@ -18,6 +18,7 @@ parameter_defaults:
BarbicanAdmin: {protocol: 'http', port: '9311', host: 'IP_ADDRESS'}
BarbicanInternal: {protocol: 'http', port: '9311', host: 'IP_ADDRESS'}
BarbicanPublic: {protocol: 'https', port: '13311', host: 'IP_ADDRESS'}
CephDashboardInternal: {protocol: 'https', port: '8444', host: 'IP_ADDRESS'}
CephGrafanaInternal: {protocol: 'https', port: '3100', host: 'IP_ADDRESS'}
CephRgwAdmin: {protocol: 'http', port: '8080', host: 'IP_ADDRESS'}
CephRgwInternal: {protocol: 'http', port: '8080', host: 'IP_ADDRESS'}

1
environments/ssl/tls-everywhere-endpoints-dns.yaml
View File

@ -18,6 +18,7 @@ parameter_defaults:
BarbicanAdmin: {protocol: 'https', port: '9311', host: 'CLOUDNAME'}
BarbicanInternal: {protocol: 'https', port: '9311', host: 'CLOUDNAME'}
BarbicanPublic: {protocol: 'https', port: '13311', host: 'CLOUDNAME'}
CephDashboardInternal: {protocol: 'https', port: '8444', host: 'CLOUDNAME'}
CephGrafanaInternal: {protocol: 'https', port: '3100', host: 'CLOUDNAME'}
CephRgwAdmin: {protocol: 'https', port: '8080', host: 'CLOUDNAME'}
CephRgwInternal: {protocol: 'https', port: '8080', host: 'CLOUDNAME'}

5
network/endpoints/endpoint_data.yaml
View File

@ -287,6 +287,11 @@ Swift:
port: 3000
port: 8080
CephDashboard:
Internal:
net_param: CephDashboard
port: 8444
CephGrafana:
Internal:
net_param: CephGrafana

131
network/endpoints/endpoint_map.yaml
View File

@ -43,6 +43,10 @@ parameters:
protocol: http
port: '9311'
host: IP_ADDRESS
CephDashboardInternal:
protocol: http
port: '8444'
host: IP_ADDRESS
CephGrafanaInternal:
protocol: http
port: '3100'
@ -1163,6 +1167,133 @@ outputs:
- EndpointMap
- BarbicanPublic
- port
CephDashboardInternal:
host:
str_replace:
template:
get_param:
- EndpointMap
- CephDashboardInternal
- host
params:
CLOUDNAME:
get_param:
- CloudEndpoints
- get_param:
- ServiceNetMap
- CephDashboardNetwork
IP_ADDRESS:
get_param:
- NetIpMap
- str_replace:
params:
NETWORK:
get_param:
- ServiceNetMap
- CephDashboardNetwork
template: NETWORK_uri
host_nobrackets:
str_replace:
template:
get_param:
- EndpointMap
- CephDashboardInternal
- host
params:
CLOUDNAME:
get_param:
- CloudEndpoints
- get_param:
- ServiceNetMap
- CephDashboardNetwork
IP_ADDRESS:
get_param:
- NetIpMap
- get_param:
- ServiceNetMap
- CephDashboardNetwork
port:
get_param:
- EndpointMap
- CephDashboardInternal
- port
protocol:
get_param:
- EndpointMap
- CephDashboardInternal
- protocol
uri:
make_url:
scheme:
get_param:
- EndpointMap
- CephDashboardInternal
- protocol
host:
str_replace:
template:
get_param:
- EndpointMap
- CephDashboardInternal
- host
params:
CLOUDNAME:
get_param:
- CloudEndpoints
- get_param:
- ServiceNetMap
- CephDashboardNetwork
IP_ADDRESS:
get_param:
- NetIpMap
- str_replace:
params:
NETWORK:
get_param:
- ServiceNetMap
- CephDashboardNetwork
template: NETWORK_uri
port:
get_param:
- EndpointMap
- CephDashboardInternal
- port
uri_no_suffix:
make_url:
scheme:
get_param:
- EndpointMap
- CephDashboardInternal
- protocol
host:
str_replace:
template:
get_param:
- EndpointMap
- CephDashboardInternal
- host
params:
CLOUDNAME:
get_param:
- CloudEndpoints
- get_param:
- ServiceNetMap
- CephDashboardNetwork
IP_ADDRESS:
get_param:
- NetIpMap
- str_replace:
params:
NETWORK:
get_param:
- ServiceNetMap
- CephDashboardNetwork
template: NETWORK_uri
port:
get_param:
- EndpointMap
- CephDashboardInternal
- port
CephGrafanaInternal:
host:
str_replace:

1
network/service_net_map.j2.yaml
View File

@ -77,6 +77,7 @@ parameters:
MysqlNetwork: {{ _service_nets.get('internal_api', 'ctlplane') }}
SnmpdNetwork: ctlplane
CephClusterNetwork: {{ _service_nets.get('storage_mgmt', 'ctlplane') }}
CephDashboardNetwork: ctlplane
CephGrafanaNetwork: {{ _service_nets.get('storage', 'ctlplane') }}
CephMonNetwork: {{ _service_nets.get('storage', 'ctlplane') }}
CephRgwNetwork: {{ _service_nets.get('storage', 'ctlplane') }}

4
sample-env-generator/ssl.yaml
View File

@ -126,6 +126,7 @@ environments:
BarbicanAdmin: {protocol: 'http', port: '9311', host: 'IP_ADDRESS'}
BarbicanInternal: {protocol: 'http', port: '9311', host: 'IP_ADDRESS'}
BarbicanPublic: {protocol: 'https', port: '13311', host: 'IP_ADDRESS'}
CephDashboardInternal: {protocol: 'https', port: '8444', host: 'IP_ADDRESS'}
CephGrafanaInternal: {protocol: 'https', port: '3100', host: 'IP_ADDRESS'}
CephRgwAdmin: {protocol: 'http', port: '8080', host: 'IP_ADDRESS'}
CephRgwInternal: {protocol: 'http', port: '8080', host: 'IP_ADDRESS'}
@ -237,6 +238,7 @@ environments:
BarbicanAdmin: {protocol: 'http', port: '9311', host: 'IP_ADDRESS'}
BarbicanInternal: {protocol: 'http', port: '9311', host: 'IP_ADDRESS'}
BarbicanPublic: {protocol: 'https', port: '13311', host: 'CLOUDNAME'}
CephDashboardInternal: {protocol: 'https', port: '8444', host: 'CLOUDNAME'}
CephGrafanaInternal: {protocol: 'https', port: '3100', host: 'CLOUDNAME'}
CephRgwAdmin: {protocol: 'http', port: '8080', host: 'IP_ADDRESS'}
CephRgwInternal: {protocol: 'http', port: '8080', host: 'IP_ADDRESS'}
@ -348,6 +350,7 @@ environments:
BarbicanAdmin: {protocol: 'https', port: '9311', host: 'CLOUDNAME'}
BarbicanInternal: {protocol: 'https', port: '9311', host: 'CLOUDNAME'}
BarbicanPublic: {protocol: 'https', port: '13311', host: 'CLOUDNAME'}
CephDashboardInternal: {protocol: 'https', port: '8444', host: 'CLOUDNAME'}
CephGrafanaInternal: {protocol: 'https', port: '3100', host: 'CLOUDNAME'}
CephRgwAdmin: {protocol: 'https', port: '8080', host: 'CLOUDNAME'}
CephRgwInternal: {protocol: 'https', port: '8080', host: 'CLOUDNAME'}
@ -469,6 +472,7 @@ environments:
BarbicanAdmin: {protocol: http, port: '9311', host: IP_ADDRESS}
BarbicanInternal: {protocol: http, port: '9311', host: IP_ADDRESS}
BarbicanPublic: {protocol: http, port: '9311', host: IP_ADDRESS}
CephDashboardInternal: {protocol: http, port: '8444', host: IP_ADDRESS}
CephGrafanaInternal: {protocol: http, port: '3100', host: IP_ADDRESS}
CephRgwAdmin: {protocol: http, port: '8080', host: IP_ADDRESS}
CephRgwInternal: {protocol: http, port: '8080', host: IP_ADDRESS}